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DETAILED ACTION 

1. Claims 1, 4, 9, 11, 14, 16, 21, 23, 26, 39, 42, 47, 48, 52, 54, 59, 60, and 64 
have been amended. Claims 2, 6, 7, 10, 18, 19, 22, 27-38, 40, 44, 45, 49, 56, 57, 
61, and 65-207 have been cancelled. Accordingly, upon entry of this preliminary 
Amendment, claims 1, 3-5, 8, 9, 11-17, 20, 21, 23-26, 39, 41-43, 46-48, 50-55, 58-60, 
and 62-64 are pending. 

Election/Restrictions 

2. Applicant's election without traverse of Claims 1 -76 in the reply filed on 
2/21/2008 is acknowledged. 

Information Disclosure Statement 

3. It is impractical for the examiner to review the references thoroughly with the 
number of references cited in the case. By initialing each of the cited references on the 
accompanying 1449 forms, the examiner is merely acknowledging the submission of the 
cited references and merely indicating that only a cursory review is made of the cited 
references. 

An applicant's duty of disclosure of material and information is not satisfied by 
presenting a patent examiner with "a mountain of largely irrelevant [material] from which 
he is presumed to have been able, with his expertise and with adequate time, to have 
found the critical [material]. It ignores the real world conditions under which examiners 
work." Rohm & Haas Co. v. Crystal Chemical Co., 722 F.2d 1556, 1573 [220 USPQ 
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289] (Fed. Cir. 1983), cert, denied, 469 U.S. 851 (1984) (Emphasis in original). Patent 
applicant has a duty not just to (disclose pertinent prior art references but to make a 
disclosure in such way as not to "bury" it within other disclosures of less relevant prior 
art; See Golden Valley Microwave Foods Inc. v. Weaver Popcorn Co. Inc., 24 USPQ2d 
1801 (N.D Ind. 1992); Molins PLC v. Textron Inc., 26 USPQ2d 1889, at 1899 (D.Del. 
1992); Penn Yan Boats, Inc. v. Sea Lark Boats, Inc. et al., 175 USPQ 260, at 272 (S.D. 
Fl- 1972). 

4. The listing of references in the Search Report is not considered to be an 
information disclosure statement (IDS) complying with 37 CFR 1 .98. 37 CFR 1 .98(a)(2) 
requires a legible copy of: (1 ) each foreign patent; (2) each publication or that portion 
which caused it to be listed; (3) for each cited pending U.S. application, the application 
specification including claims, and any drawing of the application, or that portion of the 
application which caused it to be listed including any claims directed to that portion, 
unless the cited pending U.S. application is stored in the Image File Wrapper (IFW) 
system; and (4) all other information, or that portion which caused it to be listed. In 
addition, each IDS must include a list of all patents, publications, applications, or other 
information submitted for consideration by the Office (see 37 CFR 1 .98(a)(1) and (b)), 
and MPEP § 609.04(a), subsection I. states, "the list ... must be submitted on a 
separate paper." Therefore, the references cited in the Search Report have not been 
considered. Applicant is advised that the date of submission of any item of information 
or any missing element(s) will be the date of submission for purposes of determining 
compliance with the requirements based on the time of filing the IDS, including all 
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"statement" requirements of 37 CFR 1 .97(e). 
references labeled "No Copy." 
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See MPEP § 609.05(a). See IDS for 



Specification 

5. Claims 26 and 64 are objected to because of the following informalities: The 
term "computer readable medium" is not defined in the specification. Appropriate 
correction is required. 

6. The specification is objected to as failing to provide proper antecedent basis for 
the claimed subject matter. See 37 CFR 1.75(d)(1) and MPEP § 608.01 (o). Correction 
of the following is required: The term "computer readable medium" is not defined in the 
specification. 

Claim Rejections - 35 USC § 103 

7. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

8. The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1 , 148 
USPQ 459 (1966), that are applied for establishing a background for determining 
obviousness under 35 U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent art. 
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4. Considering objective evidence present in the application indicating 
obviousness or nonobviousness. 

9. This application currently names joint inventors. In considering patentability of 
the claims under 35 U.S.C. 103(a), the examiner presumes that the subject matter of 
the various claims was commonly owned at the time any inventions covered therein 
were made absent any evidence to the contrary. Applicant is advised of the obligation 
under 37 CFR 1 .56 to point out the inventor and invention dates of each claim that was 
not commonly owned at the time a later invention was made in order for the examiner to 
consider the applicability of 35 U.S.C. 103(c) and potential 35 U.S.C. 102(e), (f) or (g) 
prior art under 35 U.S.C. 1 03(a). 

10. Claims 1 , 3-5, 8, 9, 1 2-1 7, 20, 21 , 24-26, 39, 41-43, 46-47, 50-55, 58-59, and 
62-64 are rejected under 35 U.S.C. 103(a) as being unpatentable over US 6513120 B2 
(Kanzawa et al.), and further in view of US 2002/0062397 A1 (Chang et al.). 

As to Claim 1 , Kanzawa et al. disclose an invention substantially as claimed, 
including a method of monitoring protocol response codes for a server application, the 
method comprising: 

(a) capturing communication data in a network (Kanzawa et al. - Column 6, lines 
31-35 recite capturing a login command; Figure 1 discloses in a network); 

(b) monitoring protocol response codes in communication data [sic] during a 
session (Kanzawa et al. - Column 6, lines 31-65 recite the monitoring of login error 
codes during a login session, counting the number of login failures, comparing the 
number of failures to a predefined limit, identifying the session's requester address if the 
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limit is met, and reporting to the maintenance operator when the count exceeds the 
allowed value); 

(c) determining a number of protocol response codes during the session 
(Kanzawa et al. - Column 6, lines 31-65 recite the monitoring of login error codes during 
a login session, counting the number of login failures, comparing the number of failures 
to a predefined limit, identifying the session's requester address if the limit is met, and 
reporting to the maintenance operator when the count exceeds the allowed value); and 

(d) comparing the number of protocol response codes to a predetermined 
number (Kanzawa et al. - Column 6, lines 31-65 recite the monitoring of login error 
codes during a login session, counting the number of login failures, comparing the 
number of failures to a predefined limit, identifying the session's requester address if the 
limit is met, and reporting to the maintenance operator when the count exceeds the 
allowed value). 

Kanzawa et al. do not explicitly disclose, but Chang et al. disclose an invention 
substantially as claimed, including 

connecting a client and a server (Chang et al. - Figure 1 discloses the client and 
server application connection in a network); and 

between an application of the server and the client (Chang et al. - Figure 1 
discloses the client and server application connection in a network). 

It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to combine connecting a client and a server; and between an 
application of the server and the client taught by Chang et al., with monitoring protocol 
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response codes in communication data during a session; determining a number of 
protocol response codes during the session; and comparing the number of protocol 
response codes to a predetermined number taught by Kanzawa et al. 

One of ordinary skill in the art at the time the invention was made would have 
been motivated to connect clients and servers in a secured manner (Chang et al. - 
Page 17, U [0244]). 

As to Claim 3, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the method of claim 1, 

wherein the communication data is communication over a network selected from 
the group consisting of a global communication network, a wide area network, a local 
area network, and a wireless network (Kanzawa et al. - Figure 1 discloses a local area 
network). 

As to Claim 4, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the method of claim 1 , 

wherein the communication data comprises an application protocol selected from 
the group consisting of hypertext transfer protocols, simple object access protocols, web 
distributed authoring and versioning protocols, simple mail transfer protocols, wireless 
application protocols, file transfer protocols, Internet message access protocols, post 
office protocols, web services protocols, structured hypertext transfer protocols, and 
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web-mail protocols (Chang et al. - Page 3, 1f [0035] recites networking using FTP and 
HTTP protocols). 

The motivation and obviousness arguments are the same as in Claim 1 . 

As to Claim 5, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the method of claim 1 , 

wherein the communication data can comprise HTTP requests from the client 
and HTTP responses from the server application (Chang et al. - Page 3, If [0035] 
recites networking using FTP and HTTP protocols). 

The motivation and obviousness arguments are the same as in Claim 1 . 

As to Claim 8, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the method of claim 1 , 

wherein the protocol response codes is a predetermined response code type 
(Kanzawa et al. - Column 6, lines 31-65 recite the monitoring of the type login error 
codes during a login session). 

As to Claim 9, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the method of claim 1, 

wherein the protocol response codes comprise error response codes (Kanzawa 
et al. - Column 6, lines 31-65 recite the monitoring of the type login error codes during a 
login session). 
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As to Claim 12, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the method of claim 1, 

wherein step (c) comprises determining whether the number of protocol response 
codes exceeds the predetermined number (Kanzawa et al. - Column 6, lines 31-65 
recite the monitoring of login error codes during a login session, counting the number of 
login failures, comparing the number of failures to a predefined limit, identifying the 
session's requester address if the limit is met, and reporting to the maintenance 
operator when the count exceeds the allowed value). 

As to Claim 13, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the method of claim 12, comprising 

selectively generating an alert if the number of protocol response codes exceeds 
the predetermined number (Kanzawa et al. - Column 6, lines 31-65 recite the 
monitoring of login error codes during a login session, counting the number of login 
failures, comparing the number of failures to a predefined limit, identifying the session's 
requester address if the limit is met, and reporting to the maintenance operator when 
the count exceeds the allowed value). 

As to Claim 14, Kanzawa et al. disclose an invention substantially as claimed, 
including a system for monitoring protocol response codes for a server application, the 
system comprising: 
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(a) a network interface operable to capture communication data in a network 
[sic], and operable to monitor communication data [sic] during a session (Kanzawa et al. 
- Column 6, lines 31-35 recite capturing a login command; Figure 1 discloses in a 
network; Column 6, lines 31-65 recite the monitoring of login error codes during a login 
session, counting the number of login failures, comparing the number of failures to a 
predefined limit, identifying the session's requester address if the limit is met, and 
reporting to the maintenance operator when the count exceeds the allowed value); and 

(b) a detector operable to determine a number of protocol response codes during 
the session, and operable to compare the number of protocol response codes to a 
predetermined number (Kanzawa et al. - Column 6, lines 31-65 recite the monitoring of 
login error codes during a login session, counting the number of login failures, 
comparing the number of failures to a predefined limit, identifying the session's 
requester address if the limit is met, and reporting to the maintenance operator when 
the count exceeds the allowed value). 

Kanzawa et al. do not explicitly disclose, but Chang et al. disclose an invention 
substantially as claimed, including 

connecting a client and a server (Chang et al. - Figure 1 discloses the client and 
server application connection in a network); and 

between an application of the server and the client (Chang et al. - Figure 1 
discloses the client and server application connection in a network). 

The motivation and obviousness arguments are the same as in Claim 1 . 
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As to Claim 15, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the system of claim 14, 

wherein the communication data is communication over a network selected from 
the group consisting of a global communication network, a wide area network, a local 
area network, and a wireless network (Kanzawa et al. - Figure 1 discloses a local area 
network). 

As to Claim 16, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the system of claim 14, 

wherein the communication data comprises an application protocol selected from 
the group consisting of hypertext transfer protocols, simple object access protocols, web 
distributed authoring and versioning protocols, simple mail transfer protocols, wireless 
application protocols, file transfer protocols, Internet message access protocols, post 
office protocols, web services protocols, structured hypertext transfer protocols, and 
web-mail protocols (Chang et al. - Page 3, [0035] recites networking using FTP and 
HTTP protocols). 

The motivation and obviousness arguments are the same as in Claim 1 . 

As to Claim 17, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the system of claim 14, 
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wherein the communication data can comprise HTTP requests from the client 
and HTTP responses from the server application (Chang et al. - Page 3, If [0035] 
recites networking using FTP and HTTP protocols). 

The motivation and obviousness arguments are the same as in Claim 1 . 

As to Claim 20, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the system of claim 14, 

wherein the protocol response codes is a predetermined response code type 
(Kanzawa et al. - Column 6, lines 31-65 recite the monitoring of the type login error 
codes during a login session). 

As to Claim 21 , the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the system of claim 14, 

wherein the protocol response codes comprise error response codes (Kanzawa 
et al. - Column 6, lines 31-65 recite the monitoring of the type login error codes during a 
login session). 

As to Claim 24, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the system of claim 14, wherein the 
detector is operable to determine whether the number of protocol response codes 
exceeds the predetermined number (Kanzawa et al. - Column 6, lines 31-65 recite the 
monitoring of login error codes during a login session, counting the number of login 
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failures, comparing the number of failures to a predefined limit, identifying the session's 
requester address if the limit is met, and reporting to the maintenance operator when 
the count exceeds the allowed value). 

As to Claim 25, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the system of claim 24, 

wherein the detector is operable to selectively generate an alert if the number of 
protocol response codes exceeds the predetermined number (Kanzawa et al. - Column 
6, lines 31-65 recite the monitoring of login error codes during a login session, counting 
the number of login failures, comparing the number of failures to a predefined limit, 
identifying the session's requester address if the limit is met, and reporting to the 
maintenance operator when the count exceeds the allowed value). 

As to Claim 26, Kanzawa et al. disclose an invention substantially as claimed, 
including a computer program product comprising computer-executable instructions 
embodied in a computer-readable medium for performing steps comprising: 

(a) capturing communication data in a network (Kanzawa et al. - Column 6, lines 
31-35 recite capturing a login command; Figure 1 discloses in a network); 

(b) monitoring protocol response codes in communication data [sic] during a 
session (Kanzawa et al. - Column 6, lines 31-65 recite the monitoring of login error 
codes during a login session, counting the number of login failures, comparing the 
number of failures to a predefined limit, identifying the session's requester address if the 
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limit is met, and reporting to the maintenance operator when the count exceeds the 
allowed value); 

(c) determining a number of protocol response codes during the session 
(Kanzawa et al. - Column 6, lines 31-65 recite the monitoring of login error codes during 
a login session, counting the number of login failures, comparing the number of failures 
to a predefined limit, identifying the session's requester address if the limit is met, and 
reporting to the maintenance operator when the count exceeds the allowed value); and 

(d) comparing the number of protocol response codes to a predetermined 
number (Kanzawa et al. - Column 6, lines 31-65 recite the monitoring of login error 
codes during a login session, counting the number of login failures, comparing the 
number of failures to a predefined limit, identifying the session's requester address if the 
limit is met, and reporting to the maintenance operator when the count exceeds the 
allowed value). 

Kanzawa et al. do not explicitly disclose, but Chang et al. disclose an invention 
substantially as claimed, including 

connecting a client and a server (Chang et al. - Figure 1 discloses the client and 
server application connection in a network); and 

between an application of the server and the client (Chang et al. - Figure 1 
discloses the client and server application connection in a network). 

The motivation and obviousness arguments are the same as in Claim 1 . 
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As to Claim 39, Kanzawa et al. disclose an invention substantially as claimed, 
including a method of monitoring protocol response codes for a server application, the 
method comprising: 

(a) capturing communication data in a network (Kanzawa et al. - Column 6, lines 
31-35 recite capturing a login command; Figure 1 discloses in a network); 

(b) monitoring protocol response codes in communication data (Kanzawa et al. - 
Column 6, lines 31-65 recite the monitoring of login error codes during a login session, 
counting the number of login failures, comparing the number of failures to a predefined 
limit, identifying the session's requester address if the limit is met, and reporting to the 
maintenance operator when the count exceeds the allowed value); 

(c) determining a number of protocol response codes for the server data 
(Kanzawa et al. - Column 6, lines 31-65 recite the monitoring of login error codes during 
a login session, counting the number of login failures, comparing the number of failures 
to a predefined limit, identifying the session's requester address if the limit is met, and 
reporting to the maintenance operator when the count exceeds the allowed value); and 

(d) comparing the number of protocol response codes to a predetermined 
number (Kanzawa et al. - Column 6, lines 31-65 recite the monitoring of login error 
codes during a login session, counting the number of login failures, comparing the 
number of failures to a predefined limit, identifying the session's requester address if the 
limit is met, and reporting to the maintenance operator when the count exceeds the 
allowed value). 
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Kanzawa et al. do not explicitly disclose, but Chang et al. disclose an invention 
substantially as claimed, including 

connecting a client and a server (Chang et al. - Figure 1 discloses the client and 
server application connection in a network); and 

between an application of the server and the client associated with server data 
(Chang et al. - Figure 1 discloses the client and server application connection in a 
network). 

The motivation and obviousness arguments are the same as in Claim 1 . 

As to Claim 41 , the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the method of claim 39, 

wherein the communication data is communication over a network selected from 
the group consisting of a global communication network, a wide area network, a local 
area network, and a wireless network (Kanzawa et al. - Figure 1 discloses a local area 
network). 

As to Claim 42, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the method of claim 39, 

wherein the communication data comprises an application protocol selected from 
the group consisting of hypertext transfer protocols, simple object access protocols, web 
distributed authoring and versioning protocols, simple mail transfer protocols, wireless 
application protocols, file transfer protocols, Internet message access protocols, post 
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office protocols, web services protocols, structured hypertext transfer protocols, and 
web-mail protocols (Chang et al. - Page 3, 1f [0035] recites networking using FTP and 
HTTP protocols). 

The motivation and obviousness arguments are the same as in Claim 1 . 

As to Claim 43, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the method of claim 39, 

wherein the communication data can comprise HTTP requests from the client 
and HTTP responses from the server application (Chang et al. - Page 3, U [0035] 
recites networking using FTP and HTTP protocols). 

The motivation and obviousness arguments are the same as in Claim 1 . 

As to Claim 46, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the method of claim 39, 

wherein the protocol response codes is a predetermined response code type 
(Kanzawa et al. - Column 6, lines 31-65 recite the monitoring of the type login error 
codes during a login session). 

As to Claim 47, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the method of claim 39, 
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wherein the protocol response codes comprise error response codes (Kanzawa 
et al. - Column 6, lines 31-65 recite the monitoring of the type login error codes during a 
login session). 

As to Claim 50, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the method of claim 39, 

wherein step (c) comprises determining whether the number of protocol response 
codes exceeds the predetermined number (Kanzawa et al. - Column 6, lines 31-65 
recite the monitoring of login error codes during a login session, counting the number of 
login failures, comparing the number of failures to a predefined limit, identifying the 
session's requester address if the limit is met, and reporting to the maintenance 
operator when the count exceeds the allowed value). 

As to Claim 51 , the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the method of claim 50, comprising 

selectively generating an alert if the number of protocol response codes exceeds 
the predetermined number (Kanzawa et al. - Column 6, lines 31-65 recite the 
monitoring of login error codes during a login session, counting the number of login 
failures, comparing the number of failures to a predefined limit, identifying the session's 
requester address if the limit is met, and reporting to the maintenance operator when 
the count exceeds the allowed value). 
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As to Claim 52, Kanzawa et al. disclose an invention substantially as claimed, 
including a system for monitoring protocol response codes for a server application, the 
method comprising: 

(a) a network interface operable to capture communication data in a network 
[sic], and operable to monitor communication data (Kanzawa et al. - Column 6, lines 31- 
35 recite capturing a login command; Figure 1 discloses in a network; Column 6, lines 
31-65 recite the monitoring of login error codes during a login session, counting the 
number of login failures, comparing the number of failures to a predefined limit, 
identifying the session's requester address if the limit is met, and reporting to the 
maintenance operator when the count exceeds the allowed value); and 

(b) a detector operable to determine a number of protocol response codes for the 
server data, and operable to compare the number of protocol response codes to a 
predetermined number (Kanzawa et al. - Column 6, lines 31-65 recite the monitoring of 
login error codes during a login session, counting the number of login failures, 
comparing the number of failures to a predefined limit, identifying the session's 
requester address if the limit is met, and reporting to the maintenance operator when 
the count exceeds the allowed value). 

Kanzawa et al. do not explicitly disclose, but Chang et al. disclose an invention 
substantially as claimed, including 

connecting a client and a server (Chang et al. - Figure 1 discloses the client and 
server application connection in a network); and 
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between an application of the server and the client associated with server data 
(Chang et al. - Figure 1 discloses the client and server application connection in a 
network). 

The motivation and obviousness arguments are the same as in Claim 1 . 

As to Claim 53, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the system of claim 52, 

wherein the communication data is communication over a network selected from 
the group consisting of a global communication network, a wide area network, a local 
area network, and a wireless network (Kanzawa et al. - Figure 1 discloses a local area 
network). 

As to Claim 54, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the system of claim 52, 

wherein the communication data comprises an application protocol selected from 
the group consisting of hypertext transfer protocols, simple object access protocols, web 
distributed authoring and versioning protocols, simple mail transfer protocols, wireless 
application protocols, file transfer protocols, Internet message access protocols, post 
office protocols, web services protocols, structured hypertext transfer protocols, and 
web-mail protocols (Chang et al. - Page 3, If [0035] recites networking using FTP and 
HTTP protocols). 

The motivation and obviousness arguments are the same as in Claim 1 . 
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As to Claim 55, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the system of claim 52, 

wherein the communication data can comprise HTTP requests from the client 
and HTTP responses from the server application (Chang et al. - Page 3, H [0035] 
recites networking using FTP and HTTP protocols). 

The motivation and obviousness arguments are the same as in Claim 1 . 

As to Claim 58, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the system of claim 52, wherein the 
protocol response codes is a predetermined response code type (Kanzawa et al. — 
Column 6, lines 31-65 recite the monitoring of the type login error codes during a login 
session). 

As to Claim 59, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the system of claim 52, wherein the 
protocol response codes comprise error response codes (Kanzawa et al. - Column 6, 
lines 31-65 recite the monitoring of the type login error codes during a login session). 

As to Claim 62, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the system of claim 52, 
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wherein the detector is operable to determine whether the number of protocol 
response codes exceeds the predetermined number (Kanzawa et al. - Column 6, lines 
31 -65 recite the monitoring of login error codes during a login session, counting the 
number of login failures, comparing the number of failures to a predefined limit, 
identifying the session's requester address if the limit is met, and reporting to the 
maintenance operator when the count exceeds the allowed value). 

As to Claim 63, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the system of claim 62, 

wherein the detector is operable to selectively generate an alert if the number of 
protocol response codes exceeds the predetermined number (Kanzawa et al. - Column 
6, lines 31-65 recite the monitoring of login error codes during a login session, counting 
the number of login failures, comparing the number of failures to a predefined limit, 
identifying the session's requester address if the limit is met, and reporting to the 
maintenance operator when the count exceeds the allowed value). 

As to Claim 64, Kanzawa et al. disclose an invention substantially as claimed, 
including a computer program product comprising computer-executable instructions 
embodied in a computer-readable medium for performing steps comprising: 

(a) capturing communication data in a network (Kanzawa et al. - Column 6, lines 
31-35 recite capturing a login command; Figure 1 discloses in a network); 
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(b) monitoring protocol response codes in communication data (Kanzawa et al. - 
Column 6, lines 31-65 recite the monitoring of login error codes during a login session, 
counting the number of login failures, comparing the number of failures to a predefined 
limit, identifying the session's requester address if the limit is met, and reporting to the 
maintenance operator when the count exceeds the allowed value); 

(c) determining a number of protocol response codes for the [sic] data (Kanzawa 
et al. - Column 6, lines 31-65 recite the monitoring of login error codes during a login 
session, counting the number of login failures, comparing the number of failures to a 
predefined limit, identifying the session's requester address if the limit is met, and 
reporting to the maintenance operator when the count exceeds the allowed value); and 

(d) comparing the number of protocol response codes to a predetermined 
number (Kanzawa et al. - Column 6, lines 31-65 recite the monitoring of login error 
codes during a login session, counting the number of login failures, comparing the 
number of failures to a predefined limit, identifying the session's requester address if the 
limit is met, and reporting to the maintenance operator when the count exceeds the 
allowed value). 

Kanzawa et al. do not explicitly disclose, but Chang et al. disclose an invention 
substantially as claimed, including 

connecting a client and a server (Chang et al. - Figure 1 discloses the client and 
server application connection in a network); and 
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between an application of the server and the client associated with server data 
(Chang et al. - Figure 1 discloses the client and server application connection in a 
network). 

The motivation and obviousness arguments are the same as in Claim 1 . 

11. Claims 1 1 and 23 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over the combination of Kanzawa et al. and Chang et al., and further in view of US 
2005/0138193 A1 (Encarnacion et al.). 

As to Claim 1 1 , the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the method of claim 1 , 

wherein step (c) comprises determining the number of protocol response codes 
for the predetermined plurality of sessions (Kanzawa et al. - Column 6, lines 31-65 
recite the monitoring of login error codes during a login session, counting the number of 
login failures, comparing the number of failures to a predefined limit, identifying the 
session's requester address if the limit is met, and reporting to the maintenance 
operator when the count exceeds the allowed value). 

The combination of Kanzawa et al and Change et al. does not disclose, but 
Encarnacion et al. disclose an invention substantially as claimed, including wherein step 
(b) comprises monitoring [sic] in a predetermined plurality of sessions (Encarnacion et 
al. - Page 20, H [0215] recites limiting the number of retrieval sessions to a 
predetermined number). 
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It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to combine monitoring in a predetermined number of sessions 
taught by Encarnacion et al., with monitoring protocol response codes in communication 
data [sic] during a session taught by the combination of Kanzawa et al. and Chang et al. 

One of ordinary skill in the art at the time the invention was made would have 
been motivated to limit the number of sessions to reduce the risk of security threats 
(Encarnacion et al. - Page 20, U [0215]). 

As to Claim 23, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the system of claim 14, wherein the 
detector is operable to determine the number of protocol response codes for the 
predetermined plurality of sessions (Kanzawa et al. - Column 6, lines 31-65 recite the 
monitoring of login error codes during a login session, counting the number of login 
failures, comparing the number of failures to a predefined limit, identifying the session's 
requester address if the limit is met, and reporting to the maintenance operator when 
the count exceeds the allowed value). 

The combination of Kanzawa et al and Change et al. does not disclose, but 
Encarnacion et al. disclose an invention substantially as claimed, including wherein the 
network interface is operable to monitor response codes in a predetermined plurality of 
sessions (Encarnacion et al. - Page 20, If [0215] recites limiting the number of retrieval 
sessions to a predetermined number). 

The motivation and obviousness arguments are the same as in Claim 1 1 . 
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12. Claims 48 and 60 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over the combination of Kanzawa et al. and Chang et al., and further in view of US 
6,282,281 B1 (Low). 

As to Claim 48, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the method of claim 43. 

The combination of Kanzawa et al. and Chang et al. do not explicitly disclose, but 
Low discloses an invention substantially as claimed, including wherein the server data is 
defined by a predetermined set of HTTP Unique Resource Identifiers (URIs) serviced by 
the server (Low - Claim 42 recites the set of HTTP URIs being derived from 
predetermined codes). 

It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to combine wherein the server data is defined by a predetermined 
set of HTTP Unique Resource Identifiers (URIs) serviced by the server taught by Low, 
with the server data taught by the combination of Kanzawa et al. and Chang et al. 

One of ordinary skill in the art at the time the invention was made would have 
been motivated to allow the client to specify the set of URI's when making the request 
(Low -Claim 42). 

As to Claim 60, the combination of Kanzawa et al. and Chang et al. discloses an 
invention substantially as claimed, including the system of claim 52, 
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The combination of Kanzawa et al. and Chang et al. do not explicitly disclose, but 
Low discloses an invention substantially as claimed, including wherein the server data is 
defined by a predetermined set of HTTP Unique Resource Identifiers (URIs) serviced by 
the server (Low - Claim 42 recites the set of HTTP URIs being derived from 
predetermined codes). 

The motivation and obviousness arguments are the same as in Claim 48. 



Conclusion 

13. The prior art made of record and not relied upon is considered pertinent to 

applicant's disclosure. These include: 

US 2004002501 6 A1 Trusted computer system 

US 20030208694 A1 Network security system and method 

US 6993790 B2 Host-based systematic attack detection tool 

US 7246156 B2 Method and computer program product for monitoring 

an industrial network 
US 20040146147 A1 Subscriber migration system 
US 20030236995 A1 Method and apparatus for facilitating detection of 

network intrusion 

US 200201 33585 A1 Computer program for recording and selective 

playback of a communication involving the hypertext 
transfer protocol 

US 200201 36204 3A1 Method and system for routing network traffic based 
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upon application information 
US 20020145625 A1 Distributed processing system and network monitoring 
system 

US 7124203 B2 Selective cache flushing in identity and access 

management systems 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Richard G. Keehn whose telephone number is 571-270- 
5007. The examiner can normally be reached on Monday through Thursday, 9:00am - 
8:00pm EST. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Bunjob Jaroenchonwanit can be reached on 571-272-3913. The fax phone 
number for the organization where this application or proceeding is assigned is 571- 
273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

RGK 

/Bunjob Jaroenchonwanit/ 

Supervisory Patent Examiner, Art Unit 2152 



